Subject: RE: Kcychain cracking — UNCLASSIFIED Classification: UNCLASSIFIED Yes. I'll make sure you have permissions. The image can be found at IINYCART-FS/Cases0Uny-3027571_219047/Evidence/NYC024364 It isa I TB E01. Senior Forensic Examiner From Sent: Thursday, October 17, 201911:58 AM To Cc Subject: RE: Kcychain cracking --- UNCLASSIFIED Classification: UNCLASSIFIED Is the image on OP WAN so I can take a look at it? Thank you. From: Sent: Thursday, October 17, 2019 11:56 AM To: Cc: Subject: RE: Kcychain cracking —• UNCLASSIFIED Classification: UNCLASSIFIED It isn't a T2 system, but I was having many difficulties acquiring the drive with Macquisition, so I had to remove the drive and use a TX I. This is not the latest generation of MacBook, I believe it is the generation right after they removed the CD drive, so it is recent, but not brand new. It is wry possible that this was somebody else's machine, but without being able to browse the uscmamcs. I can't be 100 %cenain. Senior Forensic Examiner 3503-011 Page 3 of SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00001900 EFTA00157085

(212)384-4838 (Office) (917)855-6666 (Cell) (212)384-1334 (Fax) From (OTD)(FBI) Sent: Thursday, October 17, 2019 9:40 AM To C Subject: RE: Keychain cracking — UNCLASSIFIED Classification: UNCLASSIFIED Good moming Is this a T2 system as well? Also, do you have any indication of who the user of the laptop may have been? As 1 reca , t ere was at least one system that I looked at when I was working on the original request that was used by someone other than him. Please let me know. Thank you! From (NY) (FBI) Sent: Wednesday, October 16, 201912:55 PM To Subject: RE: Keychain cracking — UNCLASSIFIED Classification: UNCLASSIFIED Hcy I have another MacBook Pro that is locked for the same case. The password hint is "stroke4". The passwords below did not work. Any help is appreciated. Thanks. Senior Forensic Examiner From: Sent: Thursday. September 05.201910:56 AM To: Cc: Subject: RE: Keychain cracking --- UNCLASSIFIED 3503-011 Page 4 of SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_0000 190 1 EFTA00157086

Classification: UNCLASSIFIED I'm glad we could be of assistanc Please let us know if you need anything else and don't forget to send us an update o nee your forensic analysis is complete. A brief summary (a few sentences) as to the value of STXLI's efforts/password provided is appreciated when convenient as this helps STXU focus our expertise and streamline decryption efforts in support of future investigations. Thank you, From (NY) (FBI) Sent: Thursday, September 05 201910:50 AM To Cc Subject: RE: Kcychain cracking -- UNCLASSIFIED Classification: UNCLASSIFIED You guys arc great. The password "irking" worked. I am now in the machine and imaging it. Thanks for all your help. I obviously could not have done it without you. Senior Forensic Examiner From: Sent: Thursday, September 05, 20199:47 AM To: Cc Subject: RE: Kcychain cracking -- UNCLASSIFIED Classification: UNCLASSIFIED Oh yes, NYC024353 was the one with the user account JEE and I had already obtained the user password as part of your previous request which was 'Irving' (no quotes). In his kcychain he had the following passwords which you can try: irvingirving neptunemermaid (this one was used extensively) asdfasdfasdf [this was used for a Gmail account) yes8"tin [this was the password for his multiple AirPort routers] Please let me know your results once you try them so I can update our internal system accordingly regarding your request. 3503-01 I Page 5 of SUBJECT TO PROTECTIVE ORDER PARAGRAPHS 7, 8, 9, 10, 15, and 17 EFTA_00001902 EFTA00157087